linkfox-echotik-product-video
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts to perform API queries and manage user onboarding. This includes standard subprocess calls for tools like
jqorConvertFrom-Jsonto process JSON data, and script execution for account setup. - [EXTERNAL_DOWNLOADS]: The skill downloads necessary configuration and performs authentication against the vendor's official domains (
linkfox-ai.com,linkfox.com, andtool-gateway.linkfox.com). It also references official TikTok URLs for video playback. These are within the expected scope of the vendor's service. - [DATA_EXPOSURE]: The skill stores query results in a session-specific directory within the project workspace (
linkfox/<date>/<session>/data/). This is a documented behavior for data persistence and debugging, avoiding shared temporary directories like/tmpto maintain isolation. - [REMOTE_CODE_EXECUTION]: No patterns of piping remote content to a shell or executing untrusted code were detected. All scripts are part of the skill package.
- [CREDENTIALS_SAFE]: The skill correctly manages API keys via environment variables (
LINKFOX_AGENT_API_KEY) and provides a dedicated onboarding script for users to safely obtain and configure their own credentials.
Audit Metadata